WebAuthn: Difference between revisions
→Passkey branding: remove. still clear without this, so more concise |
|||
| Line 112: | Line 112: | ||
WebAuthn does not strictly require a roaming hardware authenticator. Alternatively, a software authenticator (e.g., implemented on a smartphone) or a platform authenticator (i.e., an authenticator implemented directly on the WebAuthn Client Device) may be used. Relevant examples of platform authenticators include [[Windows Hello]]<ref>{{cite web |last1=Simons |first1=Alex |title=Secure password-less sign-in for your Microsoft account using a security key or Windows Hello |url=https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/ |publisher=[[Microsoft]] |access-date=6 March 2019 |date=20 November 2018}}</ref> and the [[Android (operating system)|Android operating system]].<ref>{{cite web |title=Android Now FIDO2 Certified, Accelerating Global Migration Beyond Passwords |url=https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |publisher=[[FIDO Alliance]] |access-date=6 March 2019 |location=BARCELONA |date=25 February 2019 |archive-date=7 March 2019 |archive-url=https://web.archive.org/web/20190307054402/https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |url-status=live }}</ref> | WebAuthn does not strictly require a roaming hardware authenticator. Alternatively, a software authenticator (e.g., implemented on a smartphone) or a platform authenticator (i.e., an authenticator implemented directly on the WebAuthn Client Device) may be used. Relevant examples of platform authenticators include [[Windows Hello]]<ref>{{cite web |last1=Simons |first1=Alex |title=Secure password-less sign-in for your Microsoft account using a security key or Windows Hello |url=https://www.microsoft.com/en-us/microsoft-365/blog/2018/11/20/sign-in-to-your-microsoft-account-without-a-password-using-windows-hello-or-a-security-key/ |publisher=[[Microsoft]] |access-date=6 March 2019 |date=20 November 2018}}</ref> and the [[Android (operating system)|Android operating system]].<ref>{{cite web |title=Android Now FIDO2 Certified, Accelerating Global Migration Beyond Passwords |url=https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |publisher=[[FIDO Alliance]] |access-date=6 March 2019 |location=BARCELONA |date=25 February 2019 |archive-date=7 March 2019 |archive-url=https://web.archive.org/web/20190307054402/https://fidoalliance.org/android-now-fido2-certified-accelerating-global-migration-beyond-passwords/ |url-status=live }}</ref> | ||
WebAuthn Hybrid Transport allows WebAuthn Client to access | WebAuthn Hybrid Transport allows the WebAuthn Client to access credentials stored on another authenticator such as a smartphone, useful in certain situations where credential sync is not viable.<ref name="Corbado-HybridTransport" /> | ||
There is a lingering misunderstanding among users that biometric data is transmitted over the network in the same manner as passwords, which is not the case.<ref>{{cite web |title=Touch ID and Beyond: Duo's Plans for WebAuthn |url=https://duo.com/blog/touchid-webauthn |publisher=Duo Security |access-date=8 March 2019 |date=5 March 2019 |archive-date=21 March 2020 |archive-url=https://web.archive.org/web/20200321174132/https://duo.com/blog/touchid-webauthn |url-status=live }}</ref><ref>{{cite web |last1=Steele |first1=Nick |title=How WebAuthn aims to solve the password problem |url=https://www.helpnetsecurity.com/2019/02/27/webauthn-solve-password-problem/ |publisher=Help Net Security |access-date=8 March 2019 |date=27 February 2019 |archive-date=28 September 2020 |archive-url=https://web.archive.org/web/20200928210027/https://www.helpnetsecurity.com/2019/02/27/webauthn-solve-password-problem/ |url-status=live }}</ref> | There is a lingering misunderstanding among users that biometric data is transmitted over the network in the same manner as passwords, which is not the case.<ref>{{cite web |title=Touch ID and Beyond: Duo's Plans for WebAuthn |url=https://duo.com/blog/touchid-webauthn |publisher=Duo Security |access-date=8 March 2019 |date=5 March 2019 |archive-date=21 March 2020 |archive-url=https://web.archive.org/web/20200321174132/https://duo.com/blog/touchid-webauthn |url-status=live }}</ref><ref>{{cite web |last1=Steele |first1=Nick |title=How WebAuthn aims to solve the password problem |url=https://www.helpnetsecurity.com/2019/02/27/webauthn-solve-password-problem/ |publisher=Help Net Security |access-date=8 March 2019 |date=27 February 2019 |archive-date=28 September 2020 |archive-url=https://web.archive.org/web/20200928210027/https://www.helpnetsecurity.com/2019/02/27/webauthn-solve-password-problem/ |url-status=live }}</ref> | ||